CVE-2017-15613

TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the new-interface variable in the cmxddns.lua file...

CVE-2017-15633

TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the new-ipgroup variable in the sessionlimits.lua file...

CVE-2017-15636

TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the new-time variable in the webfilter.lua file...

CVE-2017-15617

TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the iface variable in the interfacewan.lua file...

CVE-2017-15621

What is affected: TP-Link WVR, WAR and ER devices. Vulnerability: remote authenticated administrators can execute arbitrary commands via command injection in the olmode variable in the interface_wan.lua file. Impact: high (CVSS v3 base score 7.2; confidentiality, integrity, and availability are a...

CVE-2017-15613

Technical details for CVE-2017-15613 are not publicly available in the provided documents; monitor for updates.

CVE-2017-15632

TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the new-mppeencryption variable in the pptpserver.lua file...

CVE-2017-15630

TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the new-remotesubnet variable in the pptpclient.lua file...

CVE-2017-15615

Technical details about CVE-2017-15615 are not publicly provided in the supplied connected documents. Monitor for updates from ENISA EUVD entries; no vendor/product/version mappings or fixes are described here.

CVE-2017-15615

TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the lcpechointerval variable in the pptpclient.lua file...

CVE-2017-15629

TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the new-tunnelname variable in the pptpclient.lua file...

Webmin XSS Vulnerability - Linux

Webmin is prone to a cross-site scripting vulnerability. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:webmin:webmin"; if...

Webmin XSS Vulnerability - Windows

Webmin is prone to a cross-site scripting vulnerability. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:webmin:webmin"; if...

Command injection

custom/run.cgi in Webmin before 1.870 allows remote authenticated administrators to conduct XSS attacks via the description field in the custom command functionality...

CVE-2017-17561

SeaCMS 6.56 allows remote authenticated administrators to execute arbitrary PHP code via a crafted token field to admin/adminping.php, which interacts with data/admin/ping.php...

Code injection

SeaCMS 6.56 allows remote authenticated administrators to execute arbitrary PHP code via a crafted token field to admin/adminping.php, which interacts with data/admin/ping.php...

CVE-2017-17561

SeaCMS 6.56 is affected by an arbitrary PHP code execution vulnerability. Remote authenticated administrators can exploit a crafted token field sent to admin/admin_ping.php (which interacts with data/admin/ping.php) to run arbitrary PHP code on the server. This vulnerability is documented across ...

CVE-2017-17561

SeaCMS 6.56 allows remote authenticated administrators to execute arbitrary PHP code via a crafted token field to admin/adminping.php, which interacts with data/admin/ping.php...

Cross site scripting

Cross-site scripting XSS vulnerability in Integration Matters nJAMS 3 before 3.2.0 Hotfix 7, as used in TIBCO BusinessWorks Process Monitor through 3.0.1.3 and other products, allows remote authenticated administrators to inject arbitrary web script or HTML via the users management panel of the w...

CVE-2017-16789

CVE-2017-16789 affects Integration Matters nJAMS 3 prior to 3.2.0 Hotfix 7, as used in TIBCO BusinessWorks Process Monitor up to version 3.0.1.3 and other products. It is a cross-site scripting (XSS) vulnerability that lets remote authenticated administrators inject arbitrary web script or HTML v...